BlackDome Threat Intel MCP server

<!-- mcp-name: io.github.blackdome-ai/blackdome-mcp -->

BlackDome MCP Server

Give your AI agents direct access to live honeypot threat intelligence. Look up attacker IPs, browse indicators of compromise (IOCs), inspect captured credentials and malware payloads, profile threat actors, and render a real-time global attack map — all from Claude, Cursor, or any MCP-compatible client.

Most tools are free and need no API key (the public community tier). A subset of high-value intelligence requires a paid plan.

Quick Start

Option 1 — Cloud MCP (recommended, no install)

One URL, works in every client that supports remote MCP (Claude Desktop, the claude.ai web app, mobile, Cursor):

https://api.blackdome.ai/mcp

Free tools work with no key. To unlock the paid tiers (credential intelligence, payloads, actors, warboard, STIX export), get an API key at https://blackdome.ai/pricing and add it as an Authorization header:

{
  "mcpServers": {
    "blackdome-cloud": {
      "url": "https://api.blackdome.ai/mcp",
      "headers": {
        "Authorization": "Bearer bd_your_key_here"
      }
    }
  }
}

Option 2 — Run it locally

Use uvx (part of uv) — it fetches and runs the server on demand, with no separate install step and no PATH issues:

uvx blackdome-mcp

Prefer a fixed install? pip install blackdome-mcp works too — but note the troubleshooting item at the bottom if your client says "command not found".

The free public tools work with no API key. To unlock the paid tiers, get a key at https://blackdome.ai/pricing.

Claude Desktop

Merge this into claudedesktopconfig.json — ~/Library/Application Support/Claude/ on macOS, %APPDATA%\Claude\ on Windows — then restart Claude:

{
  "mcpServers": {
    "blackdome": {
      "command": "uvx",
      "args": ["blackdome-mcp"],
      "env": {
        "BLACKDOME_API_KEY": "bd_your_key_here"
      }
    }
  }
}

The env block is optional — omit BLACKDOMEAPIKEY to run free public tools only.

Claude Code

One command — the key is stored in the MCP config, so there are no shell exports to maintain (a plain export BLACKDOMEAPIKEY=... only lasts for that terminal session, and your paid tools would stop working in the next one):

claude mcp add blackdome -e BLACKDOME_API_KEY=bd_your_key_here -- uvx blackdome-mcp

For free tools only:

claude mcp add blackdome -- uvx blackdome-mcp

Cursor

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

{
  "blackdome": {
    "command": "uvx",
    "args": ["blackdome-mcp"],
    "env": {
      "BLACKDOME_API_KEY": "bd_your_key_here"
    }
  }
}

API Key Behavior

• No key: free community tools work; paid tools return an explicit 401.
• Invalid key: paid tools (and whoami) fail loudly with 401 Invalid API key — there is no silent fallback to free-tier results. Free tools keep working regardless of key validity.
• Expired key / cancelled plan: 403 API key has expired / 403 Tenant account is inactive — again explicit errors, not degraded data.
• Valid key, wrong plan: a tool whose feature your plan does not include returns an explicit 403; check your granted features any time with whoami.

If a paid tool returns less than expected, run whoami first — it reports your plan, features, and live quota.

Available Tools

Free tools work with no key. Paid tools require an API key whose plan includes the listed feature.

Shortened. The full README is on GitHub.